The Twelfth Person – Leveraging Staff to Gain an Advantage Over Cyber Adversaries 

Those who follow (or play) football know an engaged, active and loud home crowd provides a homefield advantage similar to an extra player, by drowning out and distracting the opposing team. Much like football games, staff participation in cybersecurity efforts gives an organization a chance to gain the advantage over threat actors and prevent the start or spread of attacks.   

Advantage: Wider Coverage

Mitigation only works for detected and reported events.  What we don’t know CAN hurt us. 

  • Emphasize the value of reporting during training. 
  • Practice reporting regularly (phishing training scenarios, for example). 
  • If someone makes a mistake but still reports, clearly communicate that the reporting is important and appreciated.  
  • Share and celebrate unique or notable instances where a staff person prevented a threat by identifying and reporting it. 

Advantage: Everyone Knows the Game Plan

  • Clearly communication expectations for incident first-responders: Should they unplug the network cable, leave the device on, take screenshots, document everything?   
  • Ongoing training and practice allow people to move beyond freezing in the face of an attack, to response.  
  • Building up stressful situation resilience through training improves response times. 
  • Emphasize what to do rather than what not to do. (Example: “Stop, Inspect, Report” rather than “Don’t Click”). 

Advantage: A Motivated Team 

Build motivation for all by treating people as the twelfth person in the cybersecurity field, rather than as an opponent:

  • Acknowledge ongoing staff cybersecurity efforts. Example: “We received your report and are taking steps to investigate this situation.” 
  • Thank staff when they demonstrate cybersecurity-awareness. 
  • Use positive language.  

Different people have different primary concerns. Consider these concerns for specific individuals or groups when explaining why cybersecurity importance:

  • Safety 
  • Ethical 
  • Finacial 
  • Legal 

Improving your organization’s cybersecurity game by leveraging the human element builds upon your home-field advantage. For more tips on engaging staff in organizational cybersecurity, check out the 2025 MOREnet Annual Conference.